Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/services/scheduling/__tests__/fixtures.ts

@@ -156,7 +156,26 @@ export async function createTestCustomer(business: TestBusiness): Promise<{ cust
   return { customerId: user.customerProfile!.id, userId: user.id };
 }
 
+/** A guest CustomerProfile — no linked User, matching the shape CustomerService's guest-matching creates. */
+export async function createTestGuestCustomer(
+  overrides: { email?: string; phone?: string } = {},
+): Promise<{ customerId: string; email: string; phone: string }> {
+  const email = overrides.email ?? `${uniqueId("guest")}@test.local`;
+  const phone = overrides.phone ?? `+44 7700 ${Math.floor(100000 + Math.random() * 900000)}`;
+  const created = await prisma.customerProfile.create({
+    data: { firstName: "Guest", lastName: "Customer", email, phone, isGuest: true },
+  });
+  return { customerId: created.id, email, phone };
+}
+
 export async function cleanupTestBusiness(business: TestBusiness): Promise<void> {
+  // Appointment.staff is onDelete: Restrict (see prisma/schema.prisma) — a
+  // deliberate production safeguard against deleting a staff member with
+  // appointment history, but it also blocks Business's own cascade delete
+  // to StaffProfile whenever a test actually booked something. Clearing
+  // appointments first lets that cascade complete instead of the business
+  // delete silently failing and leaking a "Test Barbershop" row per run.
+  await prisma.appointment.deleteMany({ where: { businessId: business.businessId } }).catch(() => {});
   await prisma.business.delete({ where: { id: business.businessId } }).catch(() => {});
   if (business.createdUserIds.length > 0) {
     await prisma.user.deleteMany({ where: { id: { in: business.createdUserIds } } }).catch(() => {});